mm: page_ext: Introduce new iteration API

The page extension implementation assumes that all page extensions of a given page order are stored in the same memory section. The function page_ext_next() relies on this assumption by adding an offset to the current object to return the next adjacent page extension.

This behavior works as expected for flatmem but fails for sparsemem when using 1G pages. The commit cf54f310d0d3 ("mm/hugetlb: use __GFP_COMP for gigantic folios") exposes this issue, making it possible for a crash when using page_owner or page_table_check page extensions.

The problem is that for 1G pages, the page extensions may span memory section boundaries and be stored in different memory sections. This issue was not visible before commit cf54f310d0d3 ("mm/hugetlb: use __GFP_COMP for gigantic folios") because alloc_contig_pages() never passed more than MAX_PAGE_ORDER to post_alloc_hook(). However, the series introducing mentioned commit changed this behavior allowing the full 1G page order to be passed.

Reproducer:

1. Build the kernel with CONFIG_SPARSEMEM=y and table extensions support
2. Pass 'default_hugepagesz=1 page_owner=on' in the kernel command-line
3. Reserve one 1G page at run-time, this should crash (backtrace below)

To address this issue, this commit introduces a new API for iterating through page extensions. The main iteration loops are for_each_page_ext() and for_each_page_ext_order(). Both must be called with the RCU read lock taken. Here's an usage example:

"""
struct page_ext_iter iter;
struct page_ext *page_ext;

...

rcu_read_lock();

for_each_page_ext_order(page, order, page_ext, iter) {
	struct my_page_ext *obj = get_my_page_ext_obj(page_ext);
	...
}

rcu_read_unlock();
"""

include/linux/page_ext.h +16 -0

+struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter, struct page *page);
+struct page_ext *page_ext_iter_next(struct page_ext_iter *iter);
+
+/**
+ * page_ext_iter_get() - Get current page extension
+ * @iter: page extension iterator.
+ *
+ * Return: NULL if no page_ext exists for this iterator.
+ */
+static inline struct page_ext *page_ext_iter_get(const struct page_ext_iter *iter)
+{
+	return iter->page_ext;
+}
+
+/**
+ * for_each_page_ext(): iterate through page_ext objects.

include/linux/page_ext.h +15 -0

+
+/**
+ * for_each_page_ext_order(): iterate through page_ext objects
+ *                            for a given page order
+ * @__page: the page we're interested in
+ * @__order: page order to iterate through
+ * @__page_ext: struct page_ext pointer where the current page_ext
+ *              object is returned
+ * @__iter: struct page_ext_iter object (defined in the stack)
+ *
+ * IMPORTANT: must be called with RCU read lock taken.
+ */
+#define for_each_page_ext_order(__page, __order, __page_ext, __iter) \
+	for_each_page_ext(__page, (1UL << __order), __page_ext, __iter)
+
  #else /* !CONFIG_PAGE_EXTENSION */
  struct page_ext;

mm/page_ext.c +30 -0

index 641d93f6af4c1..508deb04d5ead 100644
@@ -549,3 +549,44 @@ void page_ext_put(struct page_ext *page_ext)
 
  	rcu_read_unlock();
  }
+
+/**
+ * page_ext_iter_begin() - Prepare for iterating through page extensions.
+ * @iter: page extension iterator.
+ * @page: The page we're interested in.
+ *
+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no page_ext exists for this page.
+ */
+struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter, struct page *page)
+{
+	iter->pfn = page_to_pfn(page);
+	iter->page_ext = lookup_page_ext(page);
+
+	return iter->page_ext;
+}
+
+/**
+ * page_ext_iter_next() - Get next page extension
+ * @iter: page extension iterator.
+ *
+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no next page_ext exists.
+ */
+struct page_ext *page_ext_iter_next(struct page_ext_iter *iter)
+{
+	if (WARN_ON_ONCE(!iter->page_ext))
+		return NULL;

Quoted 44 lines · Luiz Capitulino

The page extension implementation assumes that all page extensions of a given page order are stored in the same memory section. The function page_ext_next() relies on this assumption by adding an offset to the current object to return the next adjacent page extension.

This behavior works as expected for flatmem but fails for sparsemem when using 1G pages. The commit cf54f310d0d3 ("mm/hugetlb: use __GFP_COMP for gigantic folios") exposes this issue, making it possible for a crash when using page_owner or page_table_check page extensions.

The problem is that for 1G pages, the page extensions may span memory section boundaries and be stored in different memory sections. This issue was not visible before commit cf54f310d0d3 ("mm/hugetlb: use __GFP_COMP for gigantic folios") because alloc_contig_pages() never passed more than MAX_PAGE_ORDER to post_alloc_hook(). However, the series introducing mentioned commit changed this behavior allowing the full 1G page order to be passed.

Reproducer:

  1. Build the kernel with CONFIG_SPARSEMEM=y and table extensions support
  2. Pass 'default_hugepagesz=1 page_owner=on' in the kernel command-line
  3. Reserve one 1G page at run-time, this should crash (backtrace below)

To address this issue, this commit introduces a new API for iterating through page extensions. The main iteration loops are for_each_page_ext() and for_each_page_ext_order(). Both must be called with the RCU read lock taken. Here's an usage example:

"""
struct page_ext_iter iter;
struct page_ext *page_ext;

...

rcu_read_lock();
for_each_page_ext_order(page, order, page_ext, iter) { struct my_page_ext *obj = get_my_page_ext_obj(page_ext);
    ...
}
rcu_read_unlock();
"""

[...]

Quoted 16 lines

include/linux/page_ext.h +16 -0

+struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter, struct page *page);
+struct page_ext *page_ext_iter_next(struct page_ext_iter *iter);
+
+/**
+ * page_ext_iter_get() - Get current page extension
+ * @iter: page extension iterator.
+ *
+ * Return: NULL if no page_ext exists for this iterator.
+ */
+static inline struct page_ext *page_ext_iter_get(const struct page_ext_iter *iter)
+{
+    return iter->page_ext;
+}
+
+/**
+ * for_each_page_ext(): iterate through page_ext objects.

include/linux/page_ext.h static inline struct page_ext *page_ext_next(struct page_ext *curr) · line 142

Quoted 10 lines

include/linux/page_ext.h +10 -0

+ * @__page: the page we're interested in
+ * @__pgcount: how many pages to iterate through
+ * @__page_ext: struct page_ext pointer where the current page_ext
+ *              object is returned
+ * @__iter: struct page_ext_iter object (defined in the stack)
+ *
+ * IMPORTANT: must be called with RCU read lock taken.
+ */
+#define for_each_page_ext(__page, __pgcount, __page_ext, __iter) \
+    __page_ext = page_ext_iter_begin(&__iter, __page);     \

Doing stuff out of the loop is dangerous. Assume something does

if (xxx)
    for_each_page_ext()

Just move that inside the for().

for (__page_ext = page_ext_iter_begin(&__iter, __page), __iter.index = 0)

Quoted 4 lines

+    for (__iter.index = 0;                                 \
+        __page_ext && __iter.index < __pgcount;        \
+        __page_ext = page_ext_iter_next(&__iter),      \
+        __iter.index++)

Hm, if we now have an index, why not turn iter.pfn -> iter.start_pfn, and only adjust the index in page_ext_iter_next?

Then you can set the index to 0 in page_ext_iter_begin() and have here

for (__page_ext = page_ext_iter_begin(&__iter, __page),
     __page_ext && __iter.index < __pgcount, __page_ext = page_ext_iter_next(&__iter);)

A page_ext_iter_reset() could then simply reset the index=0 and lookup the page_ext(start_pfn + index) == page_ext(start_pfn)

Quoted 58 lines

include/linux/page_ext.h +15 -0

+
+/**
+ * for_each_page_ext_order(): iterate through page_ext objects
+ *                            for a given page order
+ * @__page: the page we're interested in
+ * @__order: page order to iterate through
+ * @__page_ext: struct page_ext pointer where the current page_ext
+ *              object is returned
+ * @__iter: struct page_ext_iter object (defined in the stack)
+ *
+ * IMPORTANT: must be called with RCU read lock taken.
+ */
+#define for_each_page_ext_order(__page, __order, __page_ext, __iter) \
+    for_each_page_ext(__page, (1UL << __order), __page_ext, __iter)
+

  #else /* !CONFIG_PAGE_EXTENSION */
  struct page_ext;

mm/page_ext.c +34 -0

index 641d93f6af4c1..508deb04d5ead 100644
@@ -549,3 +549,44 @@ void page_ext_put(struct page_ext *page_ext)
       rcu_read_unlock();
   }
+
+/**
+ * page_ext_iter_begin() - Prepare for iterating through page extensions.
+ * @iter: page extension iterator.
+ * @page: The page we're interested in.
+ *
+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no page_ext exists for this page.
+ */
+struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter, struct page *page)
+{
+    iter->pfn = page_to_pfn(page);
+    iter->page_ext = lookup_page_ext(page);
+
+    return iter->page_ext;
+}
+
+/**
+ * page_ext_iter_next() - Get next page extension
+ * @iter: page extension iterator.
+ *
+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no next page_ext exists.
+ */
+struct page_ext *page_ext_iter_next(struct page_ext_iter *iter)
+{
+    if (WARN_ON_ONCE(!iter->page_ext))
+        return NULL;
+
+    iter->pfn++;
+> +    if (page_ext_iter_next_fast_possible(iter->pfn)) {
+        iter->page_ext = page_ext_next(iter->page_ext);

mm/page_ext.c void page_ext_put(struct page_ext *page_ext) · line 592

Quoted 6 lines

mm/page_ext.c +6 -0

+    } else {
+        iter->page_ext = lookup_page_ext(pfn_to_page(iter->pfn));
+    }
+
+    return iter->page_ext;
+}

We now always have a function call when calling into page_ext_iter_next(). Could we move that to the header and rather expose lookup_page_ext() ?

Quoted 5 lines

Quoted 4 lines

+    for (__iter.index = 0;                                 \
+        __page_ext && __iter.index < __pgcount;        \
+        __page_ext = page_ext_iter_next(&__iter),      \
+        __iter.index++)

Quoted 7 lines

Hm, if we now have an index, why not turn iter.pfn -> iter.start_pfn, and only adjust the index in page_ext_iter_next?

Then you can set the index to 0 in page_ext_iter_begin() and have here

for (__page_ext = page_ext_iter_begin(&__iter, __page),
     __page_ext && __iter.index < __pgcount, __page_ext = page_ext_iter_next(&__iter);)

I can do this if you feel strong about it, but I prefer explicitly over implicitly. I moved the index into the iter object just to avoid having to define it in the macro's body. Also, the way I did it allows for using page_ext_iter_begin()/page_ext_iter_next() own their if the need arises.

Quoted 3 lines

A page_ext_iter_reset() could then simply reset the index=0 and lookup the page_ext(start_pfn + index) == page_ext(start_pfn)

Just note we don't have page_ext_iter_reset() today (and I guess it's not needed).

Quoted 59 lines

Quoted 59 lines

include/linux/page_ext.h +15 -0

+
+/**
+ * for_each_page_ext_order(): iterate through page_ext objects
+ *                            for a given page order
+ * @__page: the page we're interested in
+ * @__order: page order to iterate through
+ * @__page_ext: struct page_ext pointer where the current page_ext
+ *              object is returned
+ * @__iter: struct page_ext_iter object (defined in the stack)
+ *
+ * IMPORTANT: must be called with RCU read lock taken.
+ */
+#define for_each_page_ext_order(__page, __order, __page_ext, __iter) \
+    for_each_page_ext(__page, (1UL << __order), __page_ext, __iter)
+
   #else /* !CONFIG_PAGE_EXTENSION */
   struct page_ext;

mm/page_ext.c +34 -0

index 641d93f6af4c1..508deb04d5ead 100644
@@ -549,3 +549,44 @@ void page_ext_put(struct page_ext *page_ext)
       rcu_read_unlock();
   }
+
+/**
+ * page_ext_iter_begin() - Prepare for iterating through page extensions.
+ * @iter: page extension iterator.
+ * @page: The page we're interested in.
+ *
+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no page_ext exists for this page.
+ */
+struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter, struct page *page)
+{
+    iter->pfn = page_to_pfn(page);
+    iter->page_ext = lookup_page_ext(page);
+
+    return iter->page_ext;
+}
+
+/**
+ * page_ext_iter_next() - Get next page extension
+ * @iter: page extension iterator.
+ *
+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no next page_ext exists.
+ */
+struct page_ext *page_ext_iter_next(struct page_ext_iter *iter)
+{
+    if (WARN_ON_ONCE(!iter->page_ext))
+        return NULL;
+
+    iter->pfn++;
+> +    if (page_ext_iter_next_fast_possible(iter->pfn)) {
+        iter->page_ext = page_ext_next(iter->page_ext);

Quoted 8 lines

mm/page_ext.c void page_ext_put(struct page_ext *page_ext) · line 592

Quoted 6 lines

mm/page_ext.c +6 -0

+    } else {
+        iter->page_ext = lookup_page_ext(pfn_to_page(iter->pfn));
+    }
+
+    return iter->page_ext;
+}

We now always have a function call when calling into page_ext_iter_next(). Could we move that to the header and rather expose lookup_page_ext() ?

I personally don't like over-using inline functions, also I don't think this code needs optimization since the current clients make the affected code paths slow anyways (and this also applies to the likely/unlikely use in page_owner and page_table_check, I'd drop all of them if you ask me). But again, I can change if this would prevent you from giving your ACK :)

Quoted 6 lines

I personally don't like over-using inline functions, also I don't think this code needs optimization since the current clients make the affected code paths slow anyways (and this also applies to the likely/unlikely use in page_owner and page_table_check, I'd drop all of them if you ask me). But again, I can change if this would prevent you from giving your ACK :)

Well, 512^512 function calls for a 1 GiB page just to traverse the page ext? :)

Quoted 13 lines

Quoted 5 lines

Quoted 4 lines

+    for (__iter.index = 0;                                 \
+        __page_ext && __iter.index < __pgcount;        \
+        __page_ext = page_ext_iter_next(&__iter),      \
+        __iter.index++)

Quoted 7 lines

Hm, if we now have an index, why not turn iter.pfn -> iter.start_pfn, and only adjust the index in page_ext_iter_next?

Then you can set the index to 0 in page_ext_iter_begin() and have here

for (__page_ext = page_ext_iter_begin(&__iter, __page), __page_ext && __iter.index < __pgcount, __page_ext = page_ext_iter_next(&__iter);)

Quoted 5 lines

I can do this if you feel strong about it, but I prefer explicitly over implicitly. I moved the index into the iter object just to avoid having to define it in the macro's body. Also, the way I did it allows for using page_ext_iter_begin()/page_ext_iter_next() own their if the need arises.

Ah, I see what you mean.

for (__page_ext = page_ext_iter_begin(&__iter, __page, __pgcount);
     __page_ext;
     __page_ext = page_ext_iter_next(&__iter))

Could do that I guess by moving the count in there as well and performing the check+increment in page_ext_iter_next.

That looks very clean to me, but no strong opinion. Having the index in there just to make a macro happy is rather weird.

Quoted 5 lines

Quoted 2 lines

A page_ext_iter_reset() could then simply reset the index=0 and lookup the page_ext(start_pfn + index) == page_ext(start_pfn)

Just note we don't have page_ext_iter_reset() today (and I guess it's not needed).

Right, was writing this before reviewing the other patch.

Quoted 68 lines

Quoted 67 lines

Quoted 47 lines

include/linux/page_ext.h +15 -0

+
+/**
+ * for_each_page_ext_order(): iterate through page_ext objects
+ *                            for a given page order
+ * @__page: the page we're interested in
+ * @__order: page order to iterate through
+ * @__page_ext: struct page_ext pointer where the current page_ext
+ *              object is returned
+ * @__iter: struct page_ext_iter object (defined in the stack)
+ *
+ * IMPORTANT: must be called with RCU read lock taken.
+ */
+#define for_each_page_ext_order(__page, __order, __page_ext, __iter) \
+    for_each_page_ext(__page, (1UL << __order), __page_ext, __iter)
+

   #else /* !CONFIG_PAGE_EXTENSION */
   struct page_ext;

mm/page_ext.c +22 -0

index 641d93f6af4c1..508deb04d5ead 100644
@@ -549,3 +549,44 @@ void page_ext_put(struct page_ext *page_ext)
        rcu_read_unlock();
    }
+
+/**
+ * page_ext_iter_begin() - Prepare for iterating through page extensions.
+ * @iter: page extension iterator.
+ * @page: The page we're interested in.
+ *
+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no page_ext exists for this page.
+ */
+struct page_ext *page_ext_iter_begin(struct page_ext_iter *iter, struct page *page)
+{
+    iter->pfn = page_to_pfn(page);
+    iter->page_ext = lookup_page_ext(page);
+
+    return iter->page_ext;
+}
+
+/**
+ * page_ext_iter_next() - Get next page extension
+ * @iter: page extension iterator.
+ *

mm/page_ext.c void page_ext_put(struct page_ext *page_ext) · line 582

Quoted 10 lines

mm/page_ext.c +10 -0

+ * Must be called with RCU read lock taken.
+ *
+ * Return: NULL if no next page_ext exists.
+ */
+struct page_ext *page_ext_iter_next(struct page_ext_iter *iter)
+{
+    if (WARN_ON_ONCE(!iter->page_ext))
+        return NULL;
+
+    iter->pfn++;

  > +> +    if (page_ext_iter_next_fast_possible(iter->pfn)) {

mm/page_ext.c void page_ext_put(struct page_ext *page_ext) · line 592

Quoted 7 lines

mm/page_ext.c +7 -0

+        iter->page_ext = page_ext_next(iter->page_ext);
+    } else {
+        iter->page_ext = lookup_page_ext(pfn_to_page(iter->pfn));
+    }
+
+    return iter->page_ext;
+}

We now always have a function call when calling into page_ext_iter_next(). Could we move that to the header and rather expose lookup_page_ext() ?

Quoted 5 lines

I personally don't like over-using inline functions, also I don't think this code needs optimization since the current clients make the affected code paths slow anyways (and this also applies to the likely/unlikely use in page_owner and page_table_check, I'd drop all of them if you ask me). But again, I can change if this would prevent you from giving your ACK :)

Well, 512^512 function calls for a 1 GiB page just to traverse the page ext? :)

The page_ext_next() function assumes that page extension objects for a page order allocation always reside in the same memory section, which may not be true and could lead to crashes. Use the new page_ext iteration API instead.

Fixes cf54f310d0d3 ("mm/hugetlb: use __GFP_COMP for gigantic folios")

Signed-off-by Luiz Capitulino <[email protected]>

---
  mm/page_table_check.c | 39 ++++++++++++---------------------------
  1 file changed, 12 insertions(+), 27 deletions(-)

mm/page_table_check.c +4 -9

index 509c6ef8de400..b52e04d31c809 100644
@@ -62,24 +62,20 @@ static struct page_table_check *get_page_table_check(struct page_ext *page_ext)
   */
  static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
  {
+	struct page_ext_iter iter;
  	struct page_ext *page_ext;
  	struct page *page;
-	unsigned long i;
  	bool anon;
 
  	if (!pfn_valid(pfn))
  		return;
 
  	page = pfn_to_page(pfn);
-	page_ext = page_ext_get(page);
-
-	if (!page_ext)
-		return;
-
  	BUG_ON(PageSlab(page));
  	anon = PageAnon(page);
 
-	for (i = 0; i < pgcnt; i++) {
+	rcu_read_lock();
+	for_each_page_ext(page, pgcnt, page_ext, iter) {
  		struct page_table_check *ptc = get_page_table_check(page_ext);
 
  		if (anon) {

@@ -89,9 +85,8 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
  			BUG_ON(atomic_read(&ptc->anon_map_count));
  			BUG_ON(atomic_dec_return(&ptc->file_map_count) < 0);
  		}
-		page_ext = page_ext_next(page_ext);
  	}
-	page_ext_put(page_ext);
+	rcu_read_unlock();
  }

/*

mm/page_table_check.c +1 -1

@@ -140,24 +130,19 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt,
   */
  void __page_table_check_zero(struct page *page, unsigned int order)
  {
+	struct page_ext_iter iter;
  	struct page_ext *page_ext;
-	unsigned long i;
 

Quoted 48 lines · Luiz Capitulino

The page_ext_next() function assumes that page extension objects for a page order allocation always reside in the same memory section, which may not be true and could lead to crashes. Use the new page_ext iteration API instead.

Fixes cf54f310d0d3 ("mm/hugetlb: use __GFP_COMP for gigantic folios")

Signed-off-by Luiz Capitulino <[email protected]>

---
  mm/page_table_check.c | 39 ++++++++++++---------------------------

  1 file changed, 12 insertions(+), 27 deletions(-)

mm/page_table_check.c +4 -9

index 509c6ef8de400..b52e04d31c809 100644
@@ -62,24 +62,20 @@ static struct page_table_check *get_page_table_check(struct page_ext *page_ext)
    */
   static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
   {
+    struct page_ext_iter iter;
       struct page_ext *page_ext;
       struct page *page;
-    unsigned long i;
       bool anon;
       if (!pfn_valid(pfn))
           return;
       page = pfn_to_page(pfn);
-    page_ext = page_ext_get(page);
-
-    if (!page_ext)
-        return;
-
       BUG_ON(PageSlab(page));
       anon = PageAnon(page);
-    for (i = 0; i < pgcnt; i++) {
+    rcu_read_lock();
+    for_each_page_ext(page, pgcnt, page_ext, iter) {
           struct page_table_check *ptc = get_page_table_check(page_ext);
           if (anon) {

@@ -89,9 +85,8 @@ static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
               BUG_ON(atomic_read(&ptc->anon_map_count));
               BUG_ON(atomic_dec_return(&ptc->file_map_count) < 0);
           }
-        page_ext = page_ext_next(page_ext);
       }
-    page_ext_put(page_ext);
+    rcu_read_unlock();
   }

[...]

Quoted 11 lines

  /*

mm/page_table_check.c +1 -3

@@ -140,24 +130,19 @@ static void page_table_check_set(unsigned long pfn, unsigned long pgcnt,
    */
   void __page_table_check_zero(struct page *page, unsigned int order)
   {
+    struct page_ext_iter iter;
       struct page_ext *page_ext;
-    unsigned long i;
       BUG_ON(PageSlab(page));
-    page_ext = page_ext_get(page);
-

mm/page_table_check.c static void page_table_check_set(unsigned long pfn, unsigned long pgcnt, · line 139

Quoted 6 lines

mm/page_table_check.c +2 -4

-    if (!page_ext)
-        return;
-
-    for (i = 0; i < (1ul << order); i++) {
+    rcu_read_lock();
+    for_each_page_ext_order(page, order, page_ext, iter) {

I would avoid introducing for_each_page_ext_order() and just pass "1 << order" as the page count.

mm/page_table_check.c static void page_table_check_set(unsigned long pfn, unsigned long pgcnt, · line 148

Quoted 10 lines

mm/page_table_check.c +1 -2

           struct page_table_check *ptc = get_page_table_check(page_ext);
           BUG_ON(atomic_read(&ptc->anon_map_count));
           BUG_ON(atomic_read(&ptc->file_map_count));
-        page_ext = page_ext_next(page_ext);
       }
-    page_ext_put(page_ext);
+    rcu_read_unlock();
   }
   void __page_table_check_pte_clear(struct mm_struct *mm, pte_t pte)

Apart from that, this looks very nice to me

Acked-by David Hildenbrand <[email protected]>

To fix this, this series introduces a new iteration API for page extension objects. The API checks if the next page extension object can be retrieved from the current section or if it needs to look up for it in another section.

...

...

 include/linux/page_ext.h | 67 +++++++++++++++++++++++++++++++++++++---
 mm/page_ext.c            | 48 ++++++++++++++++++++++++++++
 mm/page_owner.c          | 61 +++++++++++++++++-------------------
 mm/page_table_check.c    | 39 +++++++----------------
 4 files changed, 152 insertions(+), 63 deletions(-)

Quoted 6 lines · On Tue, 18 Feb 2025 21:17:46 -0500 Luiz Capitulino <[email protected]> wrote:

To fix this, this series introduces a new iteration API for page extension objects. The API checks if the next page extension object can be retrieved from the current section or if it needs to look up for it in another section.

...

A regression since 6.12, so we should backport the fix.

Quoted 7 lines

...

  include/linux/page_ext.h | 67 +++++++++++++++++++++++++++++++++++++---
  mm/page_ext.c            | 48 ++++++++++++++++++++++++++++
  mm/page_owner.c          | 61 +++++++++++++++++-------------------
  mm/page_table_check.c    | 39 +++++++----------------
  4 files changed, 152 insertions(+), 63 deletions(-)

That's a lot to backport!

Is there some quick-n-dirty fixup we can apply for the sake of -stable kernels, then work on this long-term approach for future kernels?

Quoted 19 lines · Andrew Morton

Quoted 6 lines · On Tue, 18 Feb 2025 21:17:46 -0500 Luiz Capitulino <[email protected]> wrote:

To fix this, this series introduces a new iteration API for page extension objects. The API checks if the next page extension object can be retrieved from the current section or if it needs to look up for it in another section.

...

A regression since 6.12, so we should backport the fix.

Quoted 7 lines

...

  include/linux/page_ext.h | 67 +++++++++++++++++++++++++++++++++++++--- mm/page_ext.c            | 48 ++++++++++++++++++++++++++++ mm/page_owner.c          | 61 +++++++++++++++++------------------- mm/page_table_check.c    | 39 +++++++----------------

  4 files changed, 152 insertions(+), 63 deletions(-)

Quoted 4 lines

That's a lot to backport!

Is there some quick-n-dirty fixup we can apply for the sake of -stable kernels, then work on this long-term approach for future kernels?

I assume we could loop in reset_page_owner()/page_table_check_free()/set_page_owner()/page_table_check_alloc(). Not-so-nice for upstream, maybe good-enough for stable. Still nasty :)

OTOH, we don't really expect a lot of conflicts.